Client Management Suite

We are seeing an issue whereas the Symantec Management Agent (AeXNSAgent.exe) is either hanging when powering off/rebooting with the message "Shutting down..." or when a user logs off with the message "Please wait for the System Event Notification Service...".

More detail can be found here.

This is happening mostly on servers, but I would suspect workstations to have the same issue.

Has/Is anyone else seeing this issue?

Which agent version is it?

If it is 7.1 SP2 or later then the agent service kills itself if it fails to shutdown during 10 seconds. There were quite a lot of fixes made in that area over the last years.

When agent service is shutting down on the 2008/2012 server then the desktop displays "Please wait for the Symantec Management Agent Service Service…"

I"m not sure that SMB connections have any affect on SMA service shutdown, I've never seen that. These connections are handled by the OS, the agent itself does not create those connections explicitly. They are created the same way as when you copy files in Windows Explorer from the remote share - you don;t care about closing a connection, Windows closes them.

Are you willing to take a full system memory dump next time your server hungs? This way I could find out what's holoding your system from shutting down.

Here is the acrticle describing how you can do that:

http://msdn.microsoft.com/en-us/library/windows/hardware/ff545499(v=vs.85).aspx

thanks!

Hey Sergei,

We are on 7.5.3153. This post was to see if anyone else is seeing this issue. It's difficult for me to believe we'd be the only ones experiencing this issue. We've had a case open with Symantec and Microsoft for this since earlier this year, around April.

To your point, we too were believing this was a Microsoft issue as the file transfer is happening under the System process. Microsoft has walked us through many memory dumps from our environment where they see this occurring. Their findings show that it is the AeXNSAgent.exe process that has this thread open for the file transfer, but the connection is no longer valid (the remote system no longer shows this connection).

We have a call today between myself, Microsoft and Symantec to discuss Microsoft's findings. I'll PM the case numbers to you in case you're interested.

Hello MyITGuy, was there ever a resolution to this? We are facing what appears to be a similar issue.

Thanks!

Still researching, but no resolution. Here is a brief update.

The issue is caused by an open IRP between ComputerA and ComputerB. ComputerA shows an active connection with ComputerB, but ComputerB shows no connection. ComputerB shows no crash or issue at all. Because the connection is performing a WrPageIn operation, the system cannot close the connection. Hence the hang.

We had a call between our company, Symantec and Microsoft. Microsoft stated that Symantec was doing everything correctly. Microsoft believes there is a device between ComputerA and ComputerB that did not honor the disconnect between the two and, instead, keeping the connection open.

This weekend, we turned on network capturing in an attempt to see what the systems are doing and possibly where the issue is occuring.

This issue seems to happen when Package Servers retrieve packages across a WAN connection. We have many device in between, most notibly a SonicWALL device that may be performing many actions on the packets, including Deep Packet Inspection (DPI).

Interestingly, the failures always happen on XML files in the Patch Windows System Assessment Scan Tool Package.

Go here for a little more detail.